@dxos/credentials 0.10.0 → 0.11.1

package/dist/lib/index.mjs

@@ -0,0 +1,1687 @@
+import { createKeyPair, subtleCrypto, verifySignature } from "@dxos/crypto";
+import { IdentityDid, PublicKey } from "@dxos/keys";
+import { Callback, ComplexMap, ComplexSet, arrayToBuffer } from "@dxos/util";
+import { generateMnemonic, mnemonicToSeedSync } from "bip39";
+import { invariant } from "@dxos/invariant";
+import stableStringify from "json-stable-stringify";
+import { Timeframe } from "@dxos/timeframe";
+import { AdmittedFeed, MembershipPolicy, SpaceMember } from "@dxos/protocols/proto/dxos/halo/credentials";
+import { Trigger, runInContextAsync, synchronized } from "@dxos/async";
+import { Context } from "@dxos/context";
+import { log } from "@dxos/log";
+//#region src/did.ts
+var IDENTITY_DIDS_CACHE = new ComplexMap(PublicKey.hash);
+/**
+* Identity DIDs are generated by creating a keypair, and then taking the first 20 bytes of the SHA-256 hash of the public key and encoding them to multibase RFC4648 base-32 format (prefixed with B, see Multibase Table).
+* Inspired by how ethereum addresses are derived.
+*/
+var createDidFromIdentityKey = async (identityKey) => {
+	const cachedValue = IDENTITY_DIDS_CACHE.get(identityKey);
+	if (cachedValue !== void 0) return cachedValue;
+	const digest = await subtleCrypto.digest("SHA-256", identityKey.asUint8Array());
+	const bytes = new Uint8Array(digest).slice(0, IdentityDid.byteLength);
+	const identityDid = IdentityDid.encode(bytes);
+	IDENTITY_DIDS_CACHE.set(identityKey, identityDid);
+	return identityDid;
+};
+//#endregion
+//#region src/invitations.ts
+var defaultSecretProvider = async () => Buffer.from("0000");
+var defaultSecretValidator = async (invitation, secret) => true;
+//#endregion
+//#region src/seedphrase.ts
+var __dxlog_file$7 = "/__w/dxos/dxos/packages/core/halo/credentials/src/seedphrase.ts";
+/**
+* Generate bip39 seed phrase (aka mnemonic).
+*/
+var generateSeedPhrase = () => generateMnemonic();
+/**
+* Generate key pair from seed phrase.
+*/
+var keyPairFromSeedPhrase = (seedPhrase) => {
+	invariant(seedPhrase, void 0, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$7,
+		L: 20,
+		S: void 0,
+		A: ["seedPhrase", ""]
+	});
+	return createKeyPair(mnemonicToSeedSync(seedPhrase));
+};
+//#endregion
+//#region src/passcode.ts
+/**
+* Generates a numeric passcode.
+* @param {number} length
+* @returns {string}
+*/
+var generatePasscode = (length = 4) => {
+	let passcode = "";
+	for (let i = 0; i < length; i++) passcode += `${Math.floor(Math.random() * 10)}`;
+	return passcode;
+};
+//#endregion
+//#region src/credentials/signing.ts
+/**
+* @returns The input message to be signed for a given credential.
+*/
+var getCredentialProofPayload = (credential) => {
+	const copy = {
+		...credential,
+		proof: {
+			...credential.proof,
+			value: /* @__PURE__ */ new Uint8Array(),
+			chain: void 0
+		}
+	};
+	if (copy.parentCredentialIds?.length === 0) delete copy.parentCredentialIds;
+	delete copy.id;
+	const originalAssertion = copy.subject?.assertion;
+	if (originalAssertion) {
+		const normalizedAssertion = { ...originalAssertion };
+		for (const key of Object.keys(normalizedAssertion)) {
+			const val = normalizedAssertion[key];
+			if (val === void 0 || val === null || val === 0 || val === "" || val === false || Array.isArray(val) && val.length === 0) delete normalizedAssertion[key];
+		}
+		copy.subject = {
+			...copy.subject,
+			assertion: normalizedAssertion
+		};
+	}
+	return Buffer.from(canonicalStringify(copy));
+};
+/**
+* Utility method to produce stable output for signing/verifying.
+*/
+var canonicalStringify = (obj) => stableStringify(obj, { replacer: function(key, value) {
+	if (key.toString().startsWith("__") || key.toString() === "@type") return;
+	if (value === null) return;
+	const original = this[key];
+	if (value) {
+		if (PublicKey.isPublicKey(value)) return value.toHex();
+		if (Buffer.isBuffer(value)) return value.toString("hex");
+		if (value instanceof Uint8Array) return arrayToBuffer(value).toString("hex");
+		if (value.data && value.type === "Buffer") return Buffer.from(value).toString("hex");
+		if (original instanceof Timeframe) return original.frames().reduce((frames, [key, seq]) => {
+			frames[truncateKey(key)] = seq;
+			return frames;
+		}, {});
+	}
+	return value;
+} });
+/**
+* Old key truncation method (339d...9d66) to keep backwards compatibility with credentials signed with old method
+*/
+var truncateKey = (key) => {
+	const str = key.toHex();
+	return `${str.substring(0, 4)}...${str.substring(str.length - 4)}`;
+};
+/**
+* export const truncateKey = (key: any, { length = 8, start }: TruncateKeyOptions = {}) => {
+const str = String(key);
+if (str.length <= length) {
+return str;
+}
+
+return start
+? `${str.slice(0, length)}...`
+: `${str.substring(0, length / 2)}...${str.substring(str.length - length / 2)}`;
+};
+
+{
+"04009285": 20,
+"0415004f": 0,
+"0415e6d7": 9964,
+"042a4fa9": 8,
+"0448e62f": 3,
+"04775053": 257,
+"04a6b603": 97,
+"04bc5c9d": 198,
+"04da9930": 59,
+"04df0449": 676,
+"04e122ae": 5435,
+"04ee588b": 1703
+}
+
+*/
+//#endregion
+//#region src/presentations/signing.ts
+var getPresentationProofPayload = (credentials, proof) => {
+	const copy = {
+		credentials: credentials.map((credential) => removeEmptyParentCredentialIds(credential)),
+		proof: {
+			...proof,
+			value: /* @__PURE__ */ new Uint8Array(),
+			chain: void 0
+		}
+	};
+	return Buffer.from(canonicalStringify(copy));
+};
+var removeEmptyParentCredentialIds = (credential) => {
+	const copy = {
+		...credential,
+		proof: credential.proof ? {
+			...credential.proof,
+			chain: credential.proof.chain ? { credential: removeEmptyParentCredentialIds(credential.proof.chain.credential) } : void 0
+		} : void 0
+	};
+	if (copy.parentCredentialIds?.length === 0) delete copy.parentCredentialIds;
+	return copy;
+};
+//#endregion
+//#region src/credentials/assertions.ts
+var getCredentialAssertion = (credential) => credential.subject.assertion;
+var isValidAuthorizedDeviceCredential = (credential, identityKey, deviceKey) => {
+	const assertion = getCredentialAssertion(credential);
+	return credential.subject.id.equals(deviceKey) && credential.issuer.equals(identityKey) && assertion["@type"] === "dxos.halo.credentials.AuthorizedDevice" && assertion.identityKey.equals(identityKey) && assertion.deviceKey.equals(deviceKey);
+};
+var checkCredentialType = (credential, type) => credential.subject.assertion["@type"] === type;
+var credentialTypeFilter = (type) => (credential) => checkCredentialType(credential, type);
+//#endregion
+//#region src/credentials/verifier.ts
+var SIGNATURE_TYPE_ED25519 = "ED25519Signature";
+var verifyCredential = async (credential) => {
+	if (credential.parentCredentialIds?.length === 0) delete credential.parentCredentialIds;
+	if (!credential.issuer.equals(credential.proof.signer)) {
+		if (!credential.proof.chain) return {
+			kind: "fail",
+			errors: ["Delegated credential is missing credential chain."]
+		};
+		const result = await verifyChain(credential.proof.chain, credential.issuer, credential.proof.signer);
+		if (result.kind === "fail") return result;
+	}
+	const result = await verifyCredentialSignature(credential);
+	if (result.kind === "fail") return result;
+	return { kind: "pass" };
+};
+/**
+* Verifies that the signature is valid and was made by the signer.
+* Does not validate other semantics (e.g. chains).
+*/
+var verifyCredentialSignature = async (credential) => {
+	if (credential.proof.type !== "ED25519Signature") return {
+		kind: "fail",
+		errors: [`Invalid signature type: ${credential.proof.type}`]
+	};
+	const signData = getCredentialProofPayload(credential);
+	if (!await verifySignature(credential.proof.signer, signData, credential.proof.value)) return {
+		kind: "fail",
+		errors: ["Invalid signature"]
+	};
+	return { kind: "pass" };
+};
+/**
+* Verifies that the signer has the delegated authority to create credentials on behalf of the issuer.
+*/
+var verifyChain = async (chain, authority, subject) => {
+	const result = await verifyCredential(chain.credential);
+	if (result.kind === "fail") return result;
+	if (!isValidAuthorizedDeviceCredential(chain.credential, authority, subject)) return {
+		kind: "fail",
+		errors: [`Invalid credential chain: invalid assertion for key: ${subject}`]
+	};
+	return { kind: "pass" };
+};
+//#endregion
+//#region src/credentials/credential-factory.ts
+var __dxlog_file$6 = "/__w/dxos/dxos/packages/core/halo/credentials/src/credentials/credential-factory.ts";
+/**
+* Construct a signed credential message.
+*/
+var createCredential = async ({ signer, issuer, subject, assertion, signingKey, chain, nonce, parentCredentialIds }) => {
+	invariant(assertion["@type"], "Invalid assertion.", {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$6,
+		L: 48,
+		S: void 0,
+		A: ["assertion['@type']", "'Invalid assertion.'"]
+	});
+	invariant(!!signingKey === !!chain, "Chain must be provided if and only if the signing key differs from the issuer.", {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$6,
+		L: 49,
+		S: void 0,
+		A: ["!!signingKey === !!chain", "'Chain must be provided if and only if the signing key differs from the issuer.'"]
+	});
+	if (chain) invariant((await verifyChain(chain, issuer, signingKey)).kind === "pass", "Invalid chain.", {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$6,
+		L: 52,
+		S: void 0,
+		A: ["result.kind === 'pass'", "'Invalid chain.'"]
+	});
+	const credential = {
+		issuer,
+		issuanceDate: /* @__PURE__ */ new Date(),
+		subject: {
+			id: subject,
+			assertion
+		},
+		parentCredentialIds,
+		proof: {
+			type: SIGNATURE_TYPE_ED25519,
+			creationDate: /* @__PURE__ */ new Date(),
+			signer: signingKey ?? issuer,
+			value: /* @__PURE__ */ new Uint8Array(),
+			nonce
+		}
+	};
+	const signedPayload = getCredentialProofPayload(credential);
+	credential.proof.value = await signer.sign(signingKey ?? issuer, signedPayload);
+	if (chain) credential.proof.chain = chain;
+	credential.id = PublicKey.from(await subtleCrypto.digest("SHA-256", signedPayload));
+	return credential;
+};
+var createCredentialMessage = (credential) => {
+	return {
+		"@type": "dxos.echo.feed.CredentialsMessage",
+		credential
+	};
+};
+/**
+* Issue credentials directly signed by the issuer.
+*/
+var createCredentialSignerWithKey = (signer, issuer) => ({
+	getIssuer: () => issuer,
+	createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
+		signer,
+		issuer,
+		subject,
+		assertion,
+		nonce,
+		parentCredentialIds
+	})
+});
+/**
+* Issue credentials with transitive proof via a chain.
+*/
+var createCredentialSignerWithChain = (signer, chain, signingKey) => ({
+	getIssuer: () => chain.credential.issuer,
+	createCredential: ({ subject, assertion, nonce, parentCredentialIds }) => createCredential({
+		signer,
+		issuer: chain.credential.issuer,
+		signingKey,
+		chain,
+		subject,
+		assertion,
+		nonce,
+		parentCredentialIds
+	})
+});
+//#endregion
+//#region src/credentials/credential-generator.ts
+/**
+* Utility class for generating credential messages, where the issuer is the current identity or device.
+*/
+var CredentialGenerator = class {
+	_signer;
+	_identityKey;
+	_deviceKey;
+	constructor(_signer, _identityKey, _deviceKey) {
+		this._signer = _signer;
+		this._identityKey = _identityKey;
+		this._deviceKey = _deviceKey;
+	}
+	/**
+	* Create genesis messages for new Space.
+	*/
+	async createSpaceGenesis(spaceKey, controlKey, creatorProfile, membershipPolicy = MembershipPolicy.INVITE) {
+		return [
+			await createCredential({
+				signer: this._signer,
+				issuer: spaceKey,
+				subject: spaceKey,
+				assertion: {
+					"@type": "dxos.halo.credentials.SpaceGenesis",
+					spaceKey,
+					membershipPolicy
+				}
+			}),
+			await createCredential({
+				signer: this._signer,
+				issuer: spaceKey,
+				subject: this._identityKey,
+				assertion: {
+					"@type": "dxos.halo.credentials.SpaceMember",
+					spaceKey,
+					"role": SpaceMember.Role.ADMIN,
+					"profile": creatorProfile,
+					"genesisFeedKey": controlKey
+				}
+			}),
+			await this.createFeedAdmission(spaceKey, controlKey, AdmittedFeed.Designation.CONTROL)
+		];
+	}
+	/**
+	* Create invitation.
+	* Admit identity and control and data feeds.
+	*/
+	async createMemberInvitation(spaceKey, identityKey, deviceKey, controlKey, dataKey, genesisFeedKey) {
+		return [
+			await createCredential({
+				signer: this._signer,
+				issuer: this._identityKey,
+				subject: identityKey,
+				assertion: {
+					"@type": "dxos.halo.credentials.SpaceMember",
+					spaceKey,
+					"role": SpaceMember.Role.EDITOR,
+					genesisFeedKey
+				}
+			}),
+			await this.createFeedAdmission(spaceKey, controlKey, AdmittedFeed.Designation.CONTROL),
+			await this.createFeedAdmission(spaceKey, dataKey, AdmittedFeed.Designation.DATA)
+		];
+	}
+	/**
+	* Add device to space.
+	*/
+	async createDeviceAuthorization(deviceKey) {
+		return createCredential({
+			signer: this._signer,
+			issuer: this._identityKey,
+			subject: deviceKey,
+			assertion: {
+				"@type": "dxos.halo.credentials.AuthorizedDevice",
+				"identityKey": this._identityKey,
+				deviceKey
+			}
+		});
+	}
+	/**
+	* Add device metadata.
+	*/
+	async createDeviceProfile(profile) {
+		return createCredential({
+			signer: this._signer,
+			issuer: this._identityKey,
+			subject: this._deviceKey,
+			assertion: {
+				"@type": "dxos.halo.credentials.DeviceProfile",
+				profile
+			}
+		});
+	}
+	/**
+	* Add feed to space.
+	*/
+	async createFeedAdmission(spaceKey, feedKey, designation) {
+		return createCredential({
+			signer: this._signer,
+			issuer: this._identityKey,
+			subject: feedKey,
+			assertion: {
+				"@type": "dxos.halo.credentials.AdmittedFeed",
+				spaceKey,
+				"identityKey": this._identityKey,
+				"deviceKey": this._deviceKey,
+				designation
+			}
+		});
+	}
+	async createProfileCredential(profile) {
+		return createCredential({
+			signer: this._signer,
+			issuer: this._identityKey,
+			subject: this._identityKey,
+			assertion: {
+				"@type": "dxos.halo.credentials.IdentityProfile",
+				profile
+			}
+		});
+	}
+	async createEpochCredential(spaceKey) {
+		return createCredential({
+			signer: this._signer,
+			issuer: this._identityKey,
+			subject: spaceKey,
+			assertion: {
+				"@type": "dxos.halo.credentials.Epoch",
+				"number": 0,
+				"timeframe": new Timeframe()
+			}
+		});
+	}
+};
+var createDeviceAuthorization = async (signer, identityKey, deviceKey) => {
+	return (await Promise.all([await signer.createCredential({
+		subject: deviceKey,
+		assertion: {
+			"@type": "dxos.halo.credentials.AuthorizedDevice",
+			identityKey,
+			deviceKey
+		}
+	})])).map((credential) => ({
+		"@type": "dxos.echo.feed.CredentialsMessage",
+		credential
+	}));
+};
+/**
+* @param signer - invitation signer.
+* @param identityKey - identity key of the admitted member.
+* @param spaceKey - subject space key.
+* @param genesisFeedKey - genesis feed key of the space.
+* @param role - role of the newly added member.
+* @param membershipChainHeads - ids of the last known SpaceMember credentials (branching possible).
+* @param profile - profile of the newly added member.
+* @param invitationCredentialId - id of the delegated invitation credential in case one was used to add the member.
+*/
+var createAdmissionCredentials = async (signer, identityKey, spaceKey, genesisFeedKey, role = SpaceMember.Role.ADMIN, membershipChainHeads = [], profile, invitationCredentialId, tags) => {
+	return (await Promise.all([await signer.createCredential({
+		subject: identityKey,
+		parentCredentialIds: membershipChainHeads,
+		assertion: {
+			"@type": "dxos.halo.credentials.SpaceMember",
+			spaceKey,
+			role,
+			profile,
+			genesisFeedKey,
+			invitationCredentialId,
+			"tags": tags ?? []
+		}
+	})])).map((credential) => ({ credential: { credential } }));
+};
+var createDelegatedSpaceInvitationCredential = async (signer, subject, invitation) => {
+	return { credential: { credential: await signer.createCredential({
+		subject,
+		assertion: {
+			"@type": "dxos.halo.invitations.DelegateSpaceInvitation",
+			"invitationId": invitation.invitationId,
+			"authMethod": invitation.authMethod,
+			"swarmKey": invitation.swarmKey,
+			"role": invitation.role,
+			"guestKey": invitation.guestKey,
+			"expiresOn": invitation.expiresOn,
+			"multiUse": invitation.multiUse
+		}
+	}) } };
+};
+/**
+* @param signer - credential issuer.
+* @param subject - key of the space the invitation was for.
+* @param invitationCredentialId id of a dxos.halo.invitations.DelegateSpaceInvitation credential.
+*/
+var createCancelDelegatedSpaceInvitationCredential = async (signer, subject, invitationCredentialId) => {
+	return { credential: { credential: await signer.createCredential({
+		subject,
+		assertion: {
+			"@type": "dxos.halo.invitations.CancelDelegatedInvitation",
+			"credentialId": invitationCredentialId
+		}
+	}) } };
+};
+//#endregion
+//#region src/presentations/presentation.ts
+var signPresentation = async ({ presentation, signer, signerKey, chain, nonce }) => {
+	const proof = {
+		type: SIGNATURE_TYPE_ED25519,
+		value: /* @__PURE__ */ new Uint8Array(),
+		creationDate: /* @__PURE__ */ new Date(),
+		signer: signerKey,
+		nonce
+	};
+	const signedPayload = getPresentationProofPayload(presentation.credentials ?? [], proof);
+	proof.value = await signer.sign(signerKey, signedPayload);
+	if (chain) proof.chain = chain;
+	return {
+		credentials: presentation.credentials,
+		proofs: [...presentation.proofs ?? [], proof]
+	};
+};
+//#endregion
+//#region src/presentations/verifier.ts
+var verifyPresentation = async (presentation) => {
+	const errors = [];
+	const credentialsVerifications = await Promise.all(presentation.credentials?.map((credential) => verifyCredential(credential)) ?? []);
+	for (const verification of credentialsVerifications) if (verification.kind === "fail") errors.push(...verification.errors);
+	const proofVerification = await Promise.all(presentation.proofs?.map(async (proof) => {
+		const chainVerification = await verifyPresentationChain(presentation, proof);
+		if (chainVerification.kind === "fail") return chainVerification;
+		const signatureVerification = await verifyPresentationSignature(presentation, proof);
+		if (signatureVerification.kind === "fail") return signatureVerification;
+		return { kind: "pass" };
+	}) ?? []);
+	for (const verification of proofVerification) if (verification.kind === "fail") errors.push(...verification.errors);
+	if (errors.length === 0) return { kind: "pass" };
+	return {
+		kind: "fail",
+		errors
+	};
+};
+var verifyPresentationChain = async (presentation, proof) => {
+	for (const credential of presentation.credentials ?? []) if (!credential.issuer.equals(proof.signer)) {
+		if (!proof.chain) return {
+			kind: "fail",
+			errors: ["Delegated credential is missing credential chain."]
+		};
+		const chainVerification = await verifyChain(proof.chain, credential.subject.id, proof.signer);
+		if (chainVerification.kind === "fail") return chainVerification;
+	}
+	return { kind: "pass" };
+};
+/**
+* Verifies that the signature is valid and was made by the signer.
+* Does not validate other semantics (e.g. chains).
+*/
+var verifyPresentationSignature = async (presentation, proof) => {
+	if (proof.type !== "ED25519Signature") return {
+		kind: "fail",
+		errors: [`Invalid signature type: ${proof.type}`]
+	};
+	const signData = getPresentationProofPayload(presentation.credentials ?? [], proof);
+	if (!await verifySignature(proof.signer, signData, proof.value)) return {
+		kind: "fail",
+		errors: ["Invalid signature"]
+	};
+	return { kind: "pass" };
+};
+//#endregion
+//#region src/state-machine/feed-state-machine.ts
+var __dxlog_file$5 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/feed-state-machine.ts";
+/**
+* Tracks the feed tree for a space.
+* Provides a list of admitted feeds.
+*/
+var FeedStateMachine = class {
+	_spaceKey;
+	_feeds = new ComplexMap(PublicKey.hash);
+	onFeedAdmitted = new Callback();
+	constructor(_spaceKey) {
+		this._spaceKey = _spaceKey;
+	}
+	get feeds() {
+		return this._feeds;
+	}
+	/**
+	* Processes the AdmittedFeed credential.
+	* Assumes the credential is already pre-verified
+	* and the issuer has been authorized to issue credentials of this type.
+	* @param fromFeed Key of the feed where this credential is recorded.
+	*/
+	async process(credential, fromFeed) {
+		const assertion = getCredentialAssertion(credential);
+		invariant(assertion["@type"] === "dxos.halo.credentials.AdmittedFeed", void 0, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$5,
+			L: 47,
+			S: this,
+			A: ["assertion['@type'] === 'dxos.halo.credentials.AdmittedFeed'", ""]
+		});
+		invariant(assertion.spaceKey.equals(this._spaceKey), void 0, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$5,
+			L: 48,
+			S: this,
+			A: ["assertion.spaceKey.equals(this._spaceKey)", ""]
+		});
+		const info = {
+			key: credential.subject.id,
+			credential,
+			assertion,
+			parent: fromFeed
+		};
+		this._feeds.set(credential.subject.id, info);
+		await this.onFeedAdmitted.callIfSet(info);
+	}
+};
+//#endregion
+//#region src/state-machine/invitation-state-machine.ts
+/**
+* Tracks the feed tree for a space.
+* Provides a list of admitted feeds.
+*/
+var InvitationStateMachine = class {
+	_invitations = new ComplexMap(PublicKey.hash);
+	_redeemedInvitationCredentialIds = new ComplexSet(PublicKey.hash);
+	_cancelledInvitationCredentialIds = new ComplexSet(PublicKey.hash);
+	onDelegatedInvitation = new Callback();
+	onDelegatedInvitationRemoved = new Callback();
+	get invitations() {
+		return this._invitations;
+	}
+	async process(credential) {
+		if (credential.id == null) return;
+		const assertion = getCredentialAssertion(credential);
+		switch (assertion["@type"]) {
+			case "dxos.halo.invitations.CancelDelegatedInvitation": {
+				this._cancelledInvitationCredentialIds.add(assertion.credentialId);
+				const existingInvitation = this._invitations.get(assertion.credentialId);
+				if (existingInvitation != null) {
+					this._invitations.delete(assertion.credentialId);
+					await this.onDelegatedInvitationRemoved.callIfSet({
+						credentialId: assertion.credentialId,
+						invitation: existingInvitation
+					});
+				}
+				break;
+			}
+			case "dxos.halo.invitations.DelegateSpaceInvitation":
+				if (credential.id) {
+					const isExpired = assertion.expiresOn && assertion.expiresOn.getTime() < Date.now();
+					const wasUsed = this._redeemedInvitationCredentialIds.has(credential.id) && !assertion.multiUse;
+					const wasCancelled = this._cancelledInvitationCredentialIds.has(credential.id);
+					if (isExpired || wasCancelled || wasUsed) return;
+					const invitation = { ...assertion };
+					this._invitations.set(credential.id, invitation);
+					await this.onDelegatedInvitation.callIfSet({
+						credentialId: credential.id,
+						invitation
+					});
+				}
+				break;
+			case "dxos.halo.credentials.SpaceMember":
+				if (assertion.invitationCredentialId != null) {
+					this._redeemedInvitationCredentialIds.add(assertion.invitationCredentialId);
+					const existingInvitation = this._invitations.get(assertion.invitationCredentialId);
+					if (existingInvitation != null && !existingInvitation.multiUse) {
+						this._invitations.delete(assertion.invitationCredentialId);
+						await this.onDelegatedInvitationRemoved.callIfSet({
+							credentialId: assertion.invitationCredentialId,
+							invitation: existingInvitation
+						});
+					}
+				}
+				break;
+		}
+	}
+};
+//#endregion
+//#region src/graph/credential-graph.ts
+var __dxlog_file$4 = "/__w/dxos/dxos/packages/core/halo/credentials/src/graph/credential-graph.ts";
+var CredentialGraph = class {
+	_stateHandler;
+	/**
+	* Local ids are used during traversals.
+	*/
+	_vertexIdGenerator = 1;
+	/**
+	* All credentials without parent references are connected to the root.
+	*/
+	_root = {
+		id: -1,
+		parents: [],
+		children: []
+	};
+	/**
+	* A credential which is not a parent of any other credential has the sentinel as a child.
+	* Sentinel is a virtual merge-point of all credentials.
+	*/
+	_sentinel = {
+		id: -2,
+		parents: [],
+		children: []
+	};
+	/**
+	* Vertex references are used for fast credential inserts into the graph.
+	*/
+	_vertexByCredentialId = new ComplexMap(PublicKey.hash);
+	/**
+	* The current state of the graph.
+	*/
+	_subjectToVertex = new ComplexMap(PublicKey.hash);
+	_subjectToState = new ComplexMap(PublicKey.hash);
+	onSubjectStateChanged = new Callback();
+	constructor(_stateHandler) {
+		this._stateHandler = _stateHandler;
+	}
+	getSubjectState(subjectId) {
+		return this._subjectToState.get(subjectId);
+	}
+	getState() {
+		return this._subjectToState;
+	}
+	getLeafIds() {
+		return this._sentinel.parents.map((v) => v.credential.id);
+	}
+	getGlobalStateScope() {
+		return { state: this._subjectToVertex };
+	}
+	addVertex(credential, assertion) {
+		const newVertex = {
+			id: this._vertexIdGenerator++,
+			credential,
+			assertion,
+			parents: [],
+			children: []
+		};
+		this._vertexByCredentialId.set(credential.id, newVertex);
+		const parentIds = credential.parentCredentialIds ?? [];
+		if (parentIds.length === 0) {
+			this._root.children.push(newVertex);
+			newVertex.parents.push(this._root);
+		} else for (const parentId of parentIds) {
+			const parentVertex = this._vertexByCredentialId.get(parentId);
+			if (parentVertex == null) {
+				log.error("credential skipped because of the unknown parent", {
+					credential,
+					parentId
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$4,
+					L: 72,
+					S: this
+				});
+				continue;
+			}
+			parentVertex.children.push(newVertex);
+			newVertex.parents.push(parentVertex);
+			this._removeSentinelConnection(parentVertex);
+		}
+		newVertex.children.push(this._sentinel);
+		this._sentinel.parents.push(newVertex);
+		return this._onVertexInserted(newVertex);
+	}
+	_removeSentinelConnection(vertex) {
+		const sentinelIdx = vertex.children.indexOf(this._sentinel);
+		if (sentinelIdx >= 0) {
+			vertex.children.splice(sentinelIdx, 1);
+			const vertexInSentinelIdx = this._sentinel.parents.indexOf(vertex);
+			invariant(vertexInSentinelIdx >= 0, void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 90,
+				S: this,
+				A: ["vertexInSentinelIdx >= 0", ""]
+			});
+			this._sentinel.parents.splice(vertexInSentinelIdx, 1);
+		}
+	}
+	async _onVertexInserted(newVertex) {
+		const { credential, assertion } = newVertex;
+		invariant(credential, void 0, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$4,
+			L: 97,
+			S: this,
+			A: ["credential", ""]
+		});
+		let changedSubjects = [];
+		if (this._sentinel.parents.length === 1) {
+			const subjectId = credential.subject.id;
+			if (this._stateHandler.isUpdateAllowed(this.getGlobalStateScope(), credential, assertion)) {
+				const newSubjectState = this._stateHandler.createState(credential, newVertex.assertion);
+				const prevSubjectState = this._subjectToState.get(subjectId);
+				this._subjectToState.set(subjectId, newSubjectState);
+				this._subjectToVertex.set(subjectId, newVertex);
+				if (this._stateHandler.hasStateChanged(newSubjectState, prevSubjectState)) changedSubjects.push(newSubjectState);
+			}
+		} else changedSubjects = this._recomputeState();
+		if (changedSubjects.length > 0) await this.onSubjectStateChanged.callIfSet(changedSubjects);
+	}
+	/**
+	* DFS the graph from root to sentinel pausing on merge points (nodes with multiple parents).
+	* Continue after all paths leading to a merge point converge by merging their states.
+	* In case of a concurrent update paths are replayed taking into account the state set
+	* by the winning branch.
+	*/
+	_recomputeState() {
+		const pendingPaths = /* @__PURE__ */ new Map();
+		const paths = [this._createRootPath()];
+		let lastPath = null;
+		while (lastPath == null) {
+			const path = paths.pop();
+			log("visit vertex", { id: path.head.id }, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 132,
+				S: this
+			});
+			this._updatePathState(path);
+			const convergedPaths = this._handleMergePoint(paths, pendingPaths, path);
+			if (convergedPaths == null) {
+				log("waiting for other paths", void 0, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$4,
+					L: 136,
+					S: this
+				});
+				continue;
+			}
+			const mergeResult = this._mergePaths(convergedPaths);
+			if (mergeResult.type === "replay_required") {
+				this._replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths);
+				continue;
+			}
+			const merged = mergeResult.path;
+			if (merged.head.children.length === 0) lastPath = merged;
+			else if (merged.head.children.length === 1) {
+				merged.head = merged.head.children[0];
+				paths.push(merged);
+			} else this._forkTraversal(paths, merged);
+		}
+		if (paths.length > 0) log.error("traversal finished while there were active paths", { paths: paths.map((p) => ({
+			path: toChosenPath(p),
+			head: p.head.id
+		})) }, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$4,
+			L: 155,
+			S: this
+		});
+		return this._setCurrentState(lastPath);
+	}
+	_replayFailedPaths(paths, pendingPaths, mergeResult, convergedPaths) {
+		paths.push(...mergeResult.replay.map((path) => {
+			const stateOverrides = path.stateOverrides ?? new ComplexMap(PublicKey.hash);
+			mergeResult.stateOverrides.forEach((value, key) => stateOverrides.set(key, value));
+			return {
+				...mergeResult.from,
+				chosenPath: path.chosenPath,
+				stateOverrides
+			};
+		}));
+		log("replay paths", () => ({
+			count: paths.length,
+			paths: paths.map((path) => ({
+				from: mergeResult.from.head.id,
+				path: toChosenPath(path),
+				overrides: path?.stateOverrides?.mapValues((v) => this._stateHandler.toLogString(v.assertion))
+			}))
+		}), {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$4,
+			L: 175,
+			S: this
+		});
+		const clearedPending = convergedPaths.filter((l) => !mergeResult.replay.includes(l));
+		pendingPaths.set(convergedPaths[0].head.id, clearedPending);
+	}
+	_handleMergePoint(paths, pendingPaths, path) {
+		const pendingList = pendingPaths.get(path.head.id) ?? [];
+		pendingPaths.set(path.head.id, pendingList);
+		pendingList.push(path);
+		if (pendingList.length < path.head.parents.length) return null;
+		if (path.head.id === this._sentinel.id && paths.length > 0) {
+			log("waiting for all the active paths to converge on the sentinel", void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 199,
+				S: this
+			});
+			return null;
+		}
+		pendingPaths.delete(path.head.id);
+		return pendingList;
+	}
+	_updatePathState(path) {
+		const headCredential = path.head.credential;
+		if (headCredential == null) return;
+		const updatedSubject = headCredential.subject.id;
+		path.credentials.add(headCredential.id);
+		let isUpdateAllowed = this._stateHandler.isUpdateAllowed(path, headCredential, path.head.assertion);
+		if (!isUpdateAllowed && path.head.parents[0]?.id === this._root.id) {
+			const globalState = this.getGlobalStateScope();
+			isUpdateAllowed = this._stateHandler.isUpdateAllowed(globalState, headCredential, path.head.assertion);
+		}
+		if (isUpdateAllowed) {
+			path.forkChangedSubjects.add(updatedSubject);
+			path.forkIssuers.add(headCredential.issuer);
+			path.state.set(updatedSubject, path.head);
+			log("path state updated", () => ({
+				subject: updatedSubject,
+				newState: this._stateHandler.toLogString(path.head.assertion)
+			}), {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 223,
+				S: this
+			});
+		}
+	}
+	_forkTraversal(paths, path) {
+		const choices = path.chosenPath?.[path.head.id] ?? path.head.children;
+		for (const choice of choices) {
+			log("edge traversal", {
+				from: path.head.id,
+				to: choice.id
+			}, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 234,
+				S: this
+			});
+			const fork = {
+				forkPoint: path,
+				chosenPath: {
+					...path.chosenPath,
+					[path.head.id]: [choice]
+				},
+				head: choice,
+				credentials: new ComplexSet(PublicKey.hash, path.credentials),
+				state: new ComplexMap(PublicKey.hash, [...path.state.entries()]),
+				forkIssuers: new ComplexSet(PublicKey.hash),
+				forkChangedSubjects: new ComplexSet(PublicKey.hash),
+				stateOverrides: path.stateOverrides
+			};
+			paths.push(fork);
+		}
+	}
+	/**
+	* Updates the current graph state.
+	* @returns changed states.
+	*/
+	_setCurrentState(path) {
+		const changedSubjects = [];
+		const newStateMap = new ComplexMap(PublicKey.hash);
+		const newVertexMap = new ComplexMap(PublicKey.hash);
+		for (const [subjectKey, subjectVertex] of path.state.entries()) {
+			const newState = this._stateHandler.createState(subjectVertex.credential, subjectVertex.assertion);
+			const prevState = this._subjectToState.get(subjectKey);
+			newStateMap.set(subjectKey, newState);
+			newVertexMap.set(subjectKey, subjectVertex);
+			if (this._stateHandler.hasStateChanged(newState, prevState)) changedSubjects.push(newState);
+		}
+		this._subjectToState = newStateMap;
+		this._subjectToVertex = newVertexMap;
+		return changedSubjects;
+	}
+	_leastCommonAncestor(paths) {
+		const uniqueForkPoints = paths.reduce((acc, path) => {
+			let it = path.forkPoint;
+			while (it) {
+				acc.set(it.head.id, it);
+				it = it.forkPoint;
+			}
+			return acc;
+		}, /* @__PURE__ */ new Map());
+		let maxId = this._root.id;
+		let maxState = null;
+		for (const [id, state] of uniqueForkPoints.entries()) {
+			const headCredential = state.head.credential;
+			if (headCredential != null) {
+				if (paths.every((p) => p.credentials.has(headCredential.id)) && id > maxId) {
+					maxId = id;
+					maxState = state;
+				}
+			}
+		}
+		return maxState ?? this._createRootPath();
+	}
+	/**
+	* We might be merging paths where some of them had fork points after the initial forking.
+	* We need all the paths to point to the least common fork point and contain all the changes
+	* that happened after it.
+	*/
+	_moveUpToForkPoint(forkPoint, path) {
+		if (path.chosenPath[forkPoint.head.id] == null || path.forkPoint == null) return path;
+		if (forkPoint.head.id === path.forkPoint?.head.id) return path;
+		let it = path.forkPoint;
+		while (it.head.id !== forkPoint.head.id) {
+			it.forkIssuers.forEach((iss) => path.forkIssuers.add(iss));
+			it.forkChangedSubjects.forEach((m) => path.forkChangedSubjects.add(m));
+			it = it.forkPoint;
+			path.forkPoint = it;
+		}
+		return path;
+	}
+	_mergePaths(convergedPaths) {
+		invariant(convergedPaths.length >= 1, void 0, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$4,
+			L: 324,
+			S: this,
+			A: ["convergedPaths.length >= 1", ""]
+		});
+		if (convergedPaths.length === 1) return {
+			type: "merged",
+			path: convergedPaths[0]
+		};
+		const forkPoint = this._leastCommonAncestor(convergedPaths);
+		log("merging paths", () => ({
+			forkPointId: forkPoint.head.id,
+			pathCount: convergedPaths.length,
+			forkPoints: convergedPaths.map((fp) => fp.forkPoint?.head.id)
+		}), {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$4,
+			L: 329,
+			S: this
+		});
+		const paths = convergedPaths.map((p) => this._moveUpToForkPoint(forkPoint, p));
+		invariant(forkPoint, void 0, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$4,
+			L: 335,
+			S: this,
+			A: ["forkPoint", ""]
+		});
+		const result = {
+			forkPoint: forkPoint.forkPoint,
+			chosenPath: {
+				...forkPoint.chosenPath,
+				[forkPoint.head.id]: []
+			},
+			stateOverrides: forkPoint.stateOverrides,
+			credentials: new ComplexSet(PublicKey.hash, forkPoint.credentials),
+			forkIssuers: new ComplexSet(PublicKey.hash, forkPoint.forkIssuers),
+			forkChangedSubjects: new ComplexSet(PublicKey.hash, forkPoint.forkChangedSubjects),
+			state: forkPoint.state.mapValues((v) => v),
+			head: paths[0].head
+		};
+		const subjectToBranch = new ComplexMap(PublicKey.hash);
+		for (const path of paths) {
+			log("processing a path", () => ({
+				choices: toChosenPath(path),
+				modified: path.forkChangedSubjects,
+				forkIssuers: path.forkIssuers,
+				state: path.state.mapValues((v) => this._stateHandler.toLogString(v.assertion))
+			}), {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 348,
+				S: this
+			});
+			path.forkIssuers.forEach((iss) => result.forkIssuers.add(iss));
+			path.credentials.forEach((cred) => result.credentials.add(cred));
+			result.chosenPath[forkPoint.head.id].push(...path.chosenPath[forkPoint.head.id] ?? []);
+			for (const modifiedSubject of path.forkChangedSubjects) {
+				const existingBranch = subjectToBranch.get(modifiedSubject);
+				if (existingBranch == null || this._shouldOverrideCredential(existingBranch, path, modifiedSubject)) subjectToBranch.set(modifiedSubject, path);
+			}
+		}
+		const replayPaths = /* @__PURE__ */ new Set();
+		const addReplayPath = replayPaths.add.bind(replayPaths);
+		for (const [subject, branch] of subjectToBranch.entries()) {
+			result.forkChangedSubjects.add(subject);
+			const vertex = branch.state.get(subject);
+			result.state.set(subject, vertex);
+			log("set subject state", () => ({
+				subject,
+				state: this._stateHandler.toLogString(vertex.assertion)
+			}), {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 370,
+				S: this
+			});
+			const otherPaths = paths.filter((p) => p !== branch);
+			this._stateHandler.getConflictingPaths(otherPaths, vertex).forEach(addReplayPath);
+		}
+		if (replayPaths.size > 0) return {
+			type: "replay_required",
+			replay: [...replayPaths.values()],
+			from: forkPoint,
+			stateOverrides: subjectToBranch.mapValues((v, key) => v.state.get(key))
+		};
+		return {
+			type: "merged",
+			path: result
+		};
+	}
+	/**
+	* A candidate credential is preferred over the existing credential if:
+	*  1. It is the merge-point, because it's the last credential that was issued in awareness of all
+	*  the previously existing ones.
+	*  2. A path where candidate was set contains existing credential in it, which means that the candidate
+	*  was issued after the existing credential by a legitimate issuer.
+	*  3. A state-specific logic (_stateHandler) is able to justify using the candidate credential.
+	*  4. The path where candidate was set has more issuers than the existing path (longer branch).
+	*  5. The issuance time of the candidate is after the issuance time of the existing credential (LWW).
+	*/
+	_shouldOverrideCredential(existing, candidate, modifiedSubject) {
+		const candidateVertex = candidate.state.get(modifiedSubject);
+		const currentVertex = existing.state.get(modifiedSubject);
+		if (candidateVertex.id === currentVertex.id) return false;
+		const mergePointId = existing.head.id;
+		if (candidateVertex.id === mergePointId || currentVertex.id === mergePointId) {
+			log("merge point chosen to break the tie", { mergePointId: existing.head.id }, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 408,
+				S: this
+			});
+			return mergePointId === candidateVertex.id;
+		}
+		const candidateCredential = candidateVertex.credential;
+		const currentCredential = currentVertex.credential;
+		if (existing.credentials.has(candidateCredential.id) !== candidate.credentials.has(currentCredential.id)) {
+			log("one of the credentials was overridden in another branch", {
+				current: currentVertex.id,
+				candidate: candidateVertex.id
+			}, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 415,
+				S: this
+			});
+			return candidate.credentials.has(currentCredential.id);
+		}
+		const winningCredential = this._stateHandler.tryPickWinningUpdate(existing, currentCredential, candidate, candidateCredential);
+		if (winningCredential != null) return winningCredential === candidateCredential;
+		if (candidate.forkIssuers.size !== existing.forkIssuers.size) {
+			log("longer issuers branch used to break the tie", { issuerCount: [existing.forkIssuers.size, candidate.forkIssuers.size] }, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$4,
+				L: 432,
+				S: this
+			});
+			return candidate.forkIssuers.size > existing.forkIssuers.size;
+		}
+		log("issuance date used to break the tie", void 0, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$4,
+			L: 437,
+			S: this
+		});
+		return candidateCredential.issuanceDate.getTime() > currentCredential.issuanceDate.getTime();
+	}
+	_createRootPath() {
+		return {
+			head: this._root,
+			chosenPath: {},
+			forkIssuers: new ComplexSet(PublicKey.hash),
+			forkChangedSubjects: new ComplexSet(PublicKey.hash),
+			state: new ComplexMap(PublicKey.hash),
+			credentials: new ComplexSet(PublicKey.hash)
+		};
+	}
+};
+var toChosenPath = (path) => {
+	return Object.fromEntries(Object.entries(path.chosenPath).map(([k, vs]) => [k, vs.map((v) => v.id)]));
+};
+//#endregion
+//#region src/state-machine/member-state-machine.ts
+var __dxlog_file$3 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/member-state-machine.ts";
+/**
+* Tracks the list of members (with roles) for the space.
+* Provides a list of admitted feeds.
+*/
+var MemberStateMachine = class {
+	_spaceKey;
+	_ownerKey;
+	_memberProfiles = new ComplexMap(PublicKey.hash);
+	_hashgraph = new CredentialGraph(this);
+	onMemberRoleChanged = this._hashgraph.onSubjectStateChanged;
+	constructor(_spaceKey) {
+		this._spaceKey = _spaceKey;
+	}
+	get creator() {
+		return this._ownerKey && this._hashgraph.getSubjectState(this._ownerKey);
+	}
+	get members() {
+		return this._hashgraph.getState();
+	}
+	get membershipChainHeads() {
+		return this._hashgraph.getLeafIds();
+	}
+	getRole(member) {
+		return this._getRole(this._hashgraph.getGlobalStateScope(), member);
+	}
+	/**
+	* Processes the SpaceMember credential.
+	* Assumes the credential is already pre-verified and the issuer has been authorized to issue credentials of this type.
+	*/
+	async process(credential) {
+		const assertion = getCredentialAssertion(credential);
+		switch (assertion["@type"]) {
+			case "dxos.halo.credentials.SpaceMember":
+				invariant(assertion.spaceKey.equals(this._spaceKey), void 0, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$3,
+					L: 66,
+					S: this,
+					A: ["assertion.spaceKey.equals(this._spaceKey)", ""]
+				});
+				if (this._ownerKey == null && credential.issuer === this._spaceKey) this._ownerKey = credential.subject.id;
+				if (assertion.profile != null) this._memberProfiles.set(credential.subject.id, assertion.profile);
+				await this._hashgraph.addVertex(credential, assertion);
+				break;
+			case "dxos.halo.credentials.MemberProfile": {
+				const member = this._hashgraph.getSubjectState(credential.subject.id);
+				if (member) member.profile = assertion.profile;
+				else log.warn("Member not found", { id: credential.subject.id }, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$3,
+					L: 81,
+					S: this
+				});
+				this._memberProfiles.set(credential.subject.id, assertion.profile);
+				break;
+			}
+			default: throw new Error("Invalid assertion type");
+		}
+	}
+	createState(credential, assertion) {
+		const memberKey = credential.subject.id;
+		return {
+			key: memberKey,
+			role: assertion.role,
+			credential,
+			assertion,
+			profile: this._memberProfiles.get(memberKey)
+		};
+	}
+	isUpdateAllowed(scope, credential, assertion) {
+		if (assertion.role === SpaceMember.Role.OWNER) return credential.issuer.equals(this._spaceKey);
+		const issuer = credential.issuer;
+		if (issuer.equals(credential.subject.id)) return false;
+		if (issuer.equals(assertion.spaceKey)) return true;
+		const issuerRole = this._getRole(scope, issuer);
+		return issuerRole === SpaceMember.Role.ADMIN || issuerRole === SpaceMember.Role.OWNER;
+	}
+	getConflictingPaths(paths, update) {
+		if (update.assertion.role !== SpaceMember.Role.REMOVED && update.assertion.role !== SpaceMember.Role.EDITOR) return [];
+		const memberId = update.credential.subject.id;
+		return paths.filter((p) => p.forkIssuers.has(memberId));
+	}
+	tryPickWinningUpdate(scope1, update1, scope2, update2) {
+		const path1IssuerRole = this._getRole(scope1, update1.issuer);
+		if (this._getRole(scope2, update2.issuer) === SpaceMember.Role.OWNER !== (path1IssuerRole === SpaceMember.Role.OWNER)) {
+			log("owner decision used to break the tie", void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file$3,
+				L: 139,
+				S: this
+			});
+			return path1IssuerRole === SpaceMember.Role.OWNER ? update1 : update2;
+		}
+		return null;
+	}
+	toLogString(assertion) {
+		const role = assertion?.role ?? SpaceMember.Role.REMOVED;
+		return Object.entries(SpaceMember.Role).find(([_, value]) => value === role)[0];
+	}
+	hasStateChanged(s1, s2) {
+		return s1?.role !== s2?.role;
+	}
+	_getRole(scope, memberId) {
+		if (this._ownerKey?.equals(memberId)) return SpaceMember.Role.OWNER;
+		const realRole = scope.state.get(memberId)?.assertion?.role ?? SpaceMember.Role.REMOVED;
+		if (scope.stateOverrides != null) {
+			const override = scope.stateOverrides.get(memberId);
+			if (override != null) {
+				log("member role overridden in path", () => ({
+					headId: scope.head?.id,
+					roleOverride: this.toLogString(override.assertion),
+					realRole: this.toLogString(scope.state.get(memberId)?.assertion)
+				}), {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$3,
+					L: 162,
+					S: this
+				});
+				return override.assertion.role;
+			}
+		}
+		return realRole;
+	}
+};
+//#endregion
+//#region \0@oxc-project+runtime@0.139.0/helpers/esm/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region src/state-machine/space-state-machine.ts
+var __dxlog_file$2 = "/__w/dxos/dxos/packages/core/halo/credentials/src/state-machine/space-state-machine.ts";
+/**
+* Validates and processes credentials for a single space.
+* Keeps a list of members and feeds.
+* Keeps and in-memory index of credentials and allows to query them.
+*/
+var SpaceStateMachine = class {
+	_spaceKey;
+	_members;
+	_feeds;
+	_invitations = new InvitationStateMachine();
+	_credentials = [];
+	_credentialsById = new ComplexMap(PublicKey.hash);
+	_processedCredentials = new ComplexSet(PublicKey.hash);
+	_genesisCredential;
+	_tags = [];
+	_membershipPolicy = MembershipPolicy.INVITE;
+	_credentialProcessors = [];
+	onCredentialProcessed = new Callback();
+	onMemberRoleChanged;
+	onFeedAdmitted;
+	onDelegatedInvitation = this._invitations.onDelegatedInvitation;
+	onDelegatedInvitationRemoved = this._invitations.onDelegatedInvitationRemoved;
+	constructor(_spaceKey) {
+		this._spaceKey = _spaceKey;
+		this._members = new MemberStateMachine(this._spaceKey);
+		this._feeds = new FeedStateMachine(this._spaceKey);
+		this.onMemberRoleChanged = this._members.onMemberRoleChanged;
+		this.onFeedAdmitted = this._feeds.onFeedAdmitted;
+	}
+	get creator() {
+		return this._members.creator;
+	}
+	get members() {
+		return this._members.members;
+	}
+	get membershipChainHeads() {
+		return this._members.membershipChainHeads;
+	}
+	get feeds() {
+		return this._feeds.feeds;
+	}
+	get credentials() {
+		return this._credentials.map((entry) => entry.credential);
+	}
+	get credentialEntries() {
+		return this._credentials;
+	}
+	get genesisCredential() {
+		return this._genesisCredential;
+	}
+	get tags() {
+		return this._tags;
+	}
+	get membershipPolicy() {
+		return this._membershipPolicy;
+	}
+	get invitations() {
+		return this._invitations.invitations;
+	}
+	async addCredentialProcessor(processor) {
+		if (this._credentialProcessors.find((p) => p.processor === processor)) throw new Error("Credential processor already added.");
+		const consumer = new CredentialConsumer(processor, async () => {
+			for (const credential of this.credentials) await consumer._process(credential);
+			consumer._isReadyForLiveCredentials = true;
+		}, async () => {
+			this._credentialProcessors = this._credentialProcessors.filter((p) => p !== consumer);
+		});
+		this._credentialProcessors.push(consumer);
+		await consumer.open();
+	}
+	async removeCredentialProcessor(processor) {
+		await this._credentialProcessors.find((p) => p.processor === processor)?.close();
+	}
+	getCredentialsOfType(type) {
+		return this.credentials.filter((credential) => getCredentialAssertion(credential)["@type"] === type);
+	}
+	/**
+	* @param credential Message to process.
+	* @param fromFeed Key of the feed where this credential is recorded.
+	*/
+	async process(credential, { sourceFeed, skipVerification }) {
+		if (credential.id) {
+			if (this._processedCredentials.has(credential.id)) return true;
+			this._processedCredentials.add(credential.id);
+		}
+		if (!skipVerification) {
+			const result = await verifyCredential(credential);
+			if (result.kind !== "pass") {
+				log.warn(`Invalid credential: ${result.errors.join(", ")}`, void 0, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$2,
+					L: 173,
+					S: this
+				});
+				return false;
+			}
+		}
+		const assertion = getCredentialAssertion(credential);
+		switch (assertion["@type"]) {
+			case "dxos.halo.credentials.SpaceGenesis":
+				if (this._genesisCredential) {
+					log.warn("Space already has a genesis credential.", void 0, {
+						"~LogMeta": "~LogMeta",
+						F: __dxlog_file$2,
+						L: 182,
+						S: this
+					});
+					return false;
+				}
+				if (!credential.issuer.equals(this._spaceKey)) {
+					log.warn("Space genesis credential must be issued by space.", void 0, {
+						"~LogMeta": "~LogMeta",
+						F: __dxlog_file$2,
+						L: 186,
+						S: this
+					});
+					return false;
+				}
+				if (!credential.subject.id.equals(this._spaceKey)) {
+					log.warn("Space genesis credential must be issued to space.", void 0, {
+						"~LogMeta": "~LogMeta",
+						F: __dxlog_file$2,
+						L: 190,
+						S: this
+					});
+					return false;
+				}
+				this._genesisCredential = credential;
+				this._tags = assertion.tags ?? [];
+				this._membershipPolicy = assertion.membershipPolicy ?? MembershipPolicy.INVITE;
+				break;
+			case "dxos.halo.credentials.SpaceMember":
+				if (!assertion.spaceKey.equals(this._spaceKey)) break;
+				if (!this._genesisCredential) {
+					log.warn("Space must have a genesis credential before adding members.", void 0, {
+						"~LogMeta": "~LogMeta",
+						F: __dxlog_file$2,
+						L: 205,
+						S: this
+					});
+					return false;
+				}
+				if (!this._canInviteNewMembers(credential.issuer)) {
+					log.warn(`Space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
+						"~LogMeta": "~LogMeta",
+						F: __dxlog_file$2,
+						L: 209,
+						S: this
+					});
+					return false;
+				}
+				await this._members.process(credential);
+				await this._invitations.process(credential);
+				break;
+			case "dxos.halo.credentials.MemberProfile":
+				if (!this._genesisCredential) {
+					log.warn("Space must have a genesis credential before adding members.", void 0, {
+						"~LogMeta": "~LogMeta",
+						F: __dxlog_file$2,
+						L: 220,
+						S: this
+					});
+					return false;
+				}
+				await this._members.process(credential);
+				break;
+			case "dxos.halo.credentials.AdmittedFeed":
+				if (!this._genesisCredential) {
+					log.warn("Space must have a genesis credential before admitting feeds.", void 0, {
+						"~LogMeta": "~LogMeta",
+						F: __dxlog_file$2,
+						L: 230,
+						S: this
+					});
+					return false;
+				}
+				await this._feeds.process(credential, sourceFeed);
+				break;
+			case "dxos.halo.invitations.CancelDelegatedInvitation":
+			case "dxos.halo.invitations.DelegateSpaceInvitation":
+				if (!this._canInviteNewMembers(credential.issuer)) {
+					log.warn(`Invalid invitation, space member is not authorized to invite new members: ${credential.issuer}`, void 0, {
+						"~LogMeta": "~LogMeta",
+						F: __dxlog_file$2,
+						L: 241,
+						S: this
+					});
+					return false;
+				}
+				await this._invitations.process(credential);
+				break;
+		}
+		const newEntry = {
+			credential,
+			sourceFeed,
+			revoked: false
+		};
+		this._credentials.push(newEntry);
+		if (credential.id) this._credentialsById.set(credential.id, newEntry);
+		for (const processor of this._credentialProcessors) if (processor._isReadyForLiveCredentials) await processor._process(credential);
+		await this.onCredentialProcessed.callIfSet(credential);
+		return true;
+	}
+	getMemberRole(memberKey) {
+		return this._members.getRole(memberKey);
+	}
+	hasMembershipManagementPermission(memberKey) {
+		return this._canInviteNewMembers(memberKey);
+	}
+	_canInviteNewMembers(key) {
+		if (this._membershipPolicy === MembershipPolicy.LOCKED) return key.equals(this._spaceKey) && this._members.members.size === 0;
+		return key.equals(this._spaceKey) || this._members.getRole(key) === SpaceMember.Role.ADMIN || this._members.getRole(key) === SpaceMember.Role.OWNER;
+	}
+};
+__decorate([synchronized], SpaceStateMachine.prototype, "process", null);
+var CredentialConsumer = class {
+	processor;
+	_onOpen;
+	_onClose;
+	_ctx = new Context(void 0, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$2,
+		L: 291
+	});
+	/**
+	* @internal
+	* Processor is ready to process live credentials.
+	* NOTE: Setting this flag before all existing credentials are processed will cause them to be processed out of order.
+	* Set externally.
+	*/
+	_isReadyForLiveCredentials = false;
+	constructor(processor, _onOpen, _onClose) {
+		this.processor = processor;
+		this._onOpen = _onOpen;
+		this._onClose = _onClose;
+	}
+	/**
+	* @internal
+	*/
+	async _process(credential) {
+		await runInContextAsync(this._ctx, async () => {
+			await this.processor.processCredential(credential);
+		});
+	}
+	async open() {
+		if (this._ctx.disposed) throw new Error("CredentialProcessor is disposed");
+		await this._onOpen();
+	}
+	async close() {
+		await this._ctx.dispose();
+		await this._onClose();
+	}
+};
+//#endregion
+//#region src/processor/device-state-machine.ts
+var __dxlog_file$1 = "/__w/dxos/dxos/packages/core/halo/credentials/src/processor/device-state-machine.ts";
+/**
+* Processes device invitation credentials.
+*/
+var DeviceStateMachine = class {
+	_params;
+	authorizedDeviceKeys = new ComplexMap(PublicKey.hash);
+	deviceChainReady = new Trigger();
+	deviceCredentialChain;
+	constructor(_params) {
+		this._params = _params;
+	}
+	async processCredential(credential) {
+		log("processing credential...", {
+			identityKey: this._params.identityKey,
+			deviceKey: this._params.deviceKey,
+			credential
+		}, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file$1,
+			L: 35,
+			S: this
+		});
+		if (isValidAuthorizedDeviceCredential(credential, this._params.identityKey, this._params.deviceKey)) {
+			this.deviceCredentialChain = { credential };
+			this.deviceChainReady.wake();
+		}
+		const assertion = getCredentialAssertion(credential);
+		switch (assertion["@type"]) {
+			case "dxos.halo.credentials.AuthorizedDevice":
+				this.authorizedDeviceKeys.set(assertion.deviceKey, this.authorizedDeviceKeys.get(assertion.deviceKey) ?? {});
+				log("added device", {
+					localDeviceKey: this._params.deviceKey,
+					deviceKey: assertion.deviceKey,
+					size: this.authorizedDeviceKeys.size
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$1,
+					L: 55,
+					S: this
+				});
+				this._params.onUpdate?.();
+				break;
+			case "dxos.halo.credentials.DeviceProfile":
+				invariant(this.authorizedDeviceKeys.has(credential.subject.id), "Device not found.", {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$1,
+					L: 65,
+					S: this,
+					A: ["this.authorizedDeviceKeys.has(credential.subject.id)", "'Device not found.'"]
+				});
+				if (assertion && credential.subject.id.equals(this._params.deviceKey)) log.trace("dxos.halo.device", {
+					deviceKey: credential.subject.id,
+					profile: assertion.profile
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file$1,
+					L: 68,
+					S: this
+				});
+				this.authorizedDeviceKeys.set(credential.subject.id, assertion.profile);
+				this._params.onUpdate?.();
+				break;
+		}
+	}
+};
+//#endregion
+//#region src/processor/profile-state-machine.ts
+var __dxlog_file = "/__w/dxos/dxos/packages/core/halo/credentials/src/processor/profile-state-machine.ts";
+/**
+* Processes device invitation credentials.
+*/
+var ProfileStateMachine = class {
+	_params;
+	profile;
+	constructor(_params) {
+		this._params = _params;
+	}
+	async processCredential(credential) {
+		const assertion = getCredentialAssertion(credential);
+		switch (assertion["@type"]) {
+			case "dxos.halo.credentials.IdentityProfile":
+				if (!credential.issuer.equals(this._params.identityKey) || !credential.subject.id.equals(this._params.identityKey)) {
+					log.warn("Invalid profile credential", {
+						expectedIdentity: this._params.identityKey,
+						credential
+					}, {
+						"~LogMeta": "~LogMeta",
+						F: __dxlog_file,
+						L: 34,
+						S: this
+					});
+					return;
+				}
+				this.profile = assertion.profile;
+				log("updated profile", {
+					identityKey: this._params.identityKey,
+					profile: this.profile
+				}, {
+					"~LogMeta": "~LogMeta",
+					F: __dxlog_file,
+					L: 40,
+					S: this
+				});
+				this._params.onUpdate?.();
+				break;
+		}
+	}
+};
+//#endregion
+export { CredentialGenerator, DeviceStateMachine, FeedStateMachine, InvitationStateMachine, MemberStateMachine, ProfileStateMachine, SIGNATURE_TYPE_ED25519, SpaceStateMachine, canonicalStringify, checkCredentialType, createAdmissionCredentials, createCancelDelegatedSpaceInvitationCredential, createCredential, createCredentialMessage, createCredentialSignerWithChain, createCredentialSignerWithKey, createDelegatedSpaceInvitationCredential, createDeviceAuthorization, createDidFromIdentityKey, credentialTypeFilter, defaultSecretProvider, defaultSecretValidator, generatePasscode, generateSeedPhrase, getCredentialAssertion, getCredentialProofPayload, getPresentationProofPayload, isValidAuthorizedDeviceCredential, keyPairFromSeedPhrase, signPresentation, verifyChain, verifyCredential, verifyCredentialSignature, verifyPresentation, verifyPresentationChain, verifyPresentationSignature };
+
+//# sourceMappingURL=index.mjs.map